From patchwork Tue Jan 26 15:12:35 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolas Schichan X-Patchwork-Id: 573334 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id EFA81140B97 for ; Wed, 27 Jan 2016 02:13:13 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965510AbcAZPM4 (ORCPT ); Tue, 26 Jan 2016 10:12:56 -0500 Received: from smtpfb1-g21.free.fr ([212.27.42.9]:36174 "EHLO smtpfb1-g21.free.fr" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932442AbcAZPMz (ORCPT ); Tue, 26 Jan 2016 10:12:55 -0500 Received: from smtp3-g21.free.fr (smtp3-g21.free.fr [212.27.42.3]) by smtpfb1-g21.free.fr (Postfix) with ESMTP id 09DCD77CDD3; Tue, 26 Jan 2016 16:12:47 +0100 (CET) Received: from daria.iliad.local (unknown [213.36.7.13]) by smtp3-g21.free.fr (Postfix) with ESMTP id A88A8A6228; Tue, 26 Jan 2016 16:11:07 +0100 (CET) From: Nicolas Schichan To: Sebastian Hesselbarth , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Philipp Kirchhofer Cc: Nicolas Schichan Subject: [PATCH] net: mv643xx_eth: fix packet corruption with TSO and tiny unaligned packets. Date: Tue, 26 Jan 2016 16:12:35 +0100 Message-Id: <1453821155-27561-1-git-send-email-nschichan@freebox.fr> X-Mailer: git-send-email 1.9.1 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org The code in txq_put_data() would use txq->tx_curr_desc to index the tso_hdrs/tso_hdrs_dma buffers, for less than 8 bytes unaligned fragments, which is already moved to the next descriptor at the beginning of the function. If that fragment was the last of the the skb, the next skb would use that same space to place the ip headers, overwritting that small fragment data. Fixes: 91986fd3d335 (net: mv643xx_eth: Ensure proper data alignment in TSO TX path) Signed-off-by: Nicolas Schichan Reviewed-by: Philipp Kirchhofer --- drivers/net/ethernet/marvell/mv643xx_eth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c index a0c0383..5583118 100644 --- a/drivers/net/ethernet/marvell/mv643xx_eth.c +++ b/drivers/net/ethernet/marvell/mv643xx_eth.c @@ -762,10 +762,10 @@ txq_put_data_tso(struct net_device *dev, struct tx_queue *txq, if (length <= 8 && (uintptr_t)data & 0x7) { /* Copy unaligned small data fragment to TSO header data area */ - memcpy(txq->tso_hdrs + txq->tx_curr_desc * TSO_HEADER_SIZE, + memcpy(txq->tso_hdrs + tx_index * TSO_HEADER_SIZE, data, length); desc->buf_ptr = txq->tso_hdrs_dma - + txq->tx_curr_desc * TSO_HEADER_SIZE; + + tx_index * TSO_HEADER_SIZE; } else { /* Alignment is okay, map buffer and hand off to hardware */ txq->tx_desc_mapping[tx_index] = DESC_DMA_MAP_SINGLE;